Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
ET WEB_SPECIFIC_APPS Django Authentication Bypass via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Wordpress Post SMTP Plugin Unauthenticated Account Takeover via Email Log Disclosure (CVE-2025-11833)
ET WEB_SPECIFIC_APPS Django Data Exfiltration via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Nagios Log Server API Unauthorized Access to Elasticsearch Service (CVE-2025-44824)
This rule detects attempts to exploit a deserialization vulnerability (CVE-2018-8421) in Microsoft SharePoint via a crafted workflow. The detection specifically looks for HTTP POST requests to the `/_vti_bin/webpartpages.asmx` endpoint containing `ValidateWorkflowMarkupAndCreateSupportObjects` and `workflowMarkupText` with CDATA, indicating an attempt to inject malicious XML.
This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The detection is based on HTTP GET requests to the '/createou' URI containing 'data=' in the request body, which is indicative of an exploitation attempt.
ET WEB_SPECIFIC_APPS Monsta FTP Server Side Request Forgery Attempt (CVE-2022-31827)
ET WEB_SPECIFIC_APPS Cacti links.php Multiple Parameters Cross Site Scripting Attempt (CVE-2024-43362, CVE-2024-43364)
ET WEB_SPECIFIC_APPS IPFire urlfilter.cgi QUOTA_USERS Parameter Cross Site Scripting Attempt (CVE-2025-34313)
ET WEB_SPECIFIC_APPS IPFire ids.cgi IGNORE_ENTRY_REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34303)
ET WEB_SPECIFIC_APPS IPFire fwhosts.cgi COUNTRY_CODE Parameter Cross Site Scripting Attempt (CVE-2025-34301)
ET WEB_SPECIFIC_APPS Monsta FTP Arbitrary File Upload Attempt (CVE-2025-34299)
ET WEB_SPECIFIC_APPS Adobe Coldfusion BlazeDS Java Object Deserialization Remote Code Execution (CVE-2017-3066)
ET WEB_SPECIFIC_APPS Tenda DatabaseiniSet Time Parameter Buffer Overflow Attempt (CVE-2025-12618)
ET WEB_SPECIFIC_APPS IPFire proxy.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34318)
ET WEB_SPECIFIC_APPS IPFire config.dat REMOTELOG_ADDR Parameter Cross Site Scripting Attempt (CVE-2025-34315)
ET WEB_SPECIFIC_APPS IPFire urlfilter.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34314)
ET WEB_SPECIFIC_APPS IPFire calamaris.dat Multiple Parameters Command Injection Attempt (CVE-2025-34311)
ET WEB_SPECIFIC_APPS IPFire ddns.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34309)
ET WEB_SPECIFIC_APPS IPFire firewalllogip.dat pienumber Parameter Cross Site Scripting Attempt (CVE-2025-34306)
ET WEB_SPECIFIC_APPS IPFire dns.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
Page 76 of 102